Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Threat actors expand abuse of Microsoft Visual Studio Code

jamf.com

Post reply on HN
Print view View original

141–150 of 306 posts

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#141

Post by echoangle »

mjdv wrote: post #121
echoangle wrote: post #113

Earlier quoted context omitted.

You get asked if you trust the folder you’re opening every single time you open a new folder in VsCode. Everyone probably always just says yes but it’s not like it doesn’t tell you that opening untrusted folders is dangerous.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

The message displayed when asking if you want to trust the directory is pretty clear about it.

https://code.visualstudio.com/docs/editing/workspaces/worksp...

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#142

Post by TiredOfLife »

sakjur wrote: post #77
closeparen wrote: post #62

Earlier quoted context omitted.

Never liked Eclipse, but I’ve been forced to use VSCode over my preferred JetBrains IDEs because it is the only modern mainstream editor with a competent client-server mode. As in, actually rendering the UI locally while doing all the code indexing and intelligence on the server. Corporate world would much rather maintain disposable remote VMs than help you unfuck your laptop after whatever required security upgrade…

Have you tried Jetbrains Gateway? I’m curious whether it’s insufficient or just too recent, as I’ve eyed it a few times.

Gateway is discontinued

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#143

Post by jotaen »

Not a VSCode user, so a genuine question: what are practical use-cases in which you want VSCode to automatically execute a task only by opening a folder?

Is it only for convenience so it already `npm i` or `npm start` without you having to do anything, or are there any other legitimate purposes beyond that?

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#144

Post by duskdozer »

echoangle wrote: post #139
duskdozer wrote: post #132

Earlier quoted context omitted.

The message isn't very clear on what exactly is allowed to happen. Just intuitively, I wouldn't have expected simply opening a folder would "automatically execute tasks" because that's strange to me

https://code.visualstudio.com/docs/editing/workspaces/worksp... It is very clear, the first sentence it that it may automatically execute code.

>Code provides features that may automatically execute files...

What features? What files? "may"? So will it actually happen or is it just "well it possibly could"?

I've used it to open folders that I personally made and which don't have any tasks or files that get automatically executed, and yet the message pops up anyway.

It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus"

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#145

Post by pjc50 »

josephg wrote: post #15
TheAdamist wrote: post #2

Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Im forced to use vs code (so biased), but everything seems worse than eclipse, plus these repeated security issues from malware laced projects. Theres been several posts about infected projects by fake recruiters here in the last year or two. Im guessing the answer is probably Java is why eclipse is out of favor.

> Coming from the perspective of an eclipse fan, why is VS code the defacto answer nowadays? Is eclipse good now? I used it 15 years ago. It took ages to start. It was a memory hog and it was dog slow besides. My entire team got RAM upgrades on our computers because the default company issued machines (which were quite good at the time) didn't have enough RAM to use eclipse properly. I can't imagine why it went out o…

We used to have a custom Eclipse-derived tool for embedded development, and it sucked. Poor performance, crashy, difficult to build and debug. VS code is just lighter. As well as feeling more "modern", simply due to being built with the prejudices of the mid-2010s rather than the late 90s. Eclipse 1.0 was in 2001!

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#146

Post by apple1417 »

jotaen wrote: post #143

Not a VSCode user, so a genuine question: what are practical use-cases in which you want VSCode to automatically execute a task only by opening a folder? Is it only for convenience so it already `npm i` or `npm start` without you having to do anything, or are there any other legitimate purposes beyond that?

When I used it, the one use case I used it was to automatically launch a Jekyll server - if I'm working on a site I'm almost certainly going to want to look at my changes in the browser. Now that I've switched I just run one extra command, it wasn't a big saving, but it was kind of nice.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#147

Post by echoangle »

duskdozer wrote: post #144
echoangle wrote: post #139

Earlier quoted context omitted.

https://code.visualstudio.com/docs/editing/workspaces/worksp... It is very clear, the first sentence it that it may automatically execute code.

>Code provides features that may automatically execute files... What features? What files? "may"? So will it actually happen or is it just "well it possibly could"? I've used it to open folders that I personally made and which don't have any tasks or files that get automatically executed, and yet the message pops up anyway. It's like having an antivirus program that unconditionally flags every file as "this file may…

> What features? What files? "may"? So will it actually happen or is it just "well it possibly could"?

How is code supposed to know? It probably depends on the plugins you installed.

> It's like having an antivirus program that unconditionally flags every file as "this file may contain a virus"

No, it’s like if your OS asks if you want to actually run the program you’re about to before running it the first time. And it gives you the alternative to run it in a sandbox (which is equivalent to what happens when you don’t trust the workspace, then it still opens but in restricted mode)

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#148

Post by embedding-shape »

andy_ppp wrote: post #129
mjdv wrote: post #121

Earlier quoted context omitted.

Until this post it wasn't clear to me that just opening and trusting a directory can cause code to be run without taking any other explicit actions that seem like they might involve running code, like running tests. My bad, but still!

What is the stated reasoning for arbitrary code execution as a feature? Seems pretty mad to me.

Programming projects frequently feature scripts for building and packaging said projects, those have to be run somehow.

Bundling running those into the editor seems like the mad part to me, but I've missed the whole VSCode train so probably something I'm missing.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#149

Post by realusername »

pmontra wrote: post #108

My first reaction has been: when we install some node modules, import them and eventually run them, we do grant local execution permissions to whatever the authors of those modules coded in their scripts, right? More or less every language already suffer from the same problem. Who vets the code inside a Ruby gem, a Python package, etc? Add your favorite language. However I did not know about tasks.json (I don't use V…

The reason it's worse in the js ecosystem is that you need way more packages than your average language to build anything functional.

Re: Threat actors expand abuse of Microsoft Visual Studio Code

#150

Post by perryizgr8 »

Dylan16807 wrote: post #104
perryizgr8 wrote: post #96

Earlier quoted context omitted.

The "trust project" feature has been designed to be so extremely intrusive and annoying that the first thing I do is to completely disable it whenever I install VS Code on a new computer. This "solution" was just done to tick some box and put the blame on the user when a security incident happens. It's pretty similar to Windows Vista where it annoyed you with a disruptive popup so many times during the normal course…

Vista's annoyance had a purpose, to get program developers to change things to run without escalation. They didn't want you disabling UAC, and these days it breaks things to disable UAC. By only having an upfront project-wide toggle, VS Code is much worse.

Yeah imagine if at boot Windows Vista gives you the UAC "Do you TRUST all the software you are going to run today?" and if you say yes then it just allows any random code to do whatever it wants.
Post reply on HN